DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This
means, the max TRBs that can be submitted for an EP is fixed to 32. Since the
request queue for an EP is a linked list, any number of requests can be queued
to it by the gadget layer.  However, the dwc3 driver must not submit TRBs more
than the pool it has created for. This limit wasn't respected when SG was used
resulting in submitting more than the max TRBs, eventually leading to
non-transfer of the TRBs submitted over the max limit.

Root cause:
When SG is used, there are two loops iterating to prepare TRBs:
 - Outer loop over the request_list
 - Inner loop over the SG list
The code was missing break to get out of the outer loop.

Fixes: eeb720fb (usb: dwc3: gadget: add support for SG lists)
Cc: <stable@vger.kernel.org> # v3.9+
Signed-off-by: NAmit Virdi <amit.virdi@st.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3
request (dwc3_request). So while preparing TRBs, the 'last' flag should be set
only when it is the last TRB being prepared from the last dwc3_request entry.

The current implementation uses list_is_last to check if the dwc3_request is the
last entry from the request_list. However, list_is_last returns false for the
last entry too. This is because, while preparing the first TRB from a request,
the function dwc3_prepare_one_trb modifies the request's next and prev pointers
while moving the URB to req_queued. Hence, list_is_last always returns false no
matter what.

The correct way is not to access the modified pointers of dwc3_request but to
use list_empty macro instead.

Fixes: e5ba5ec8 (usb: dwc3: gadget: fix scatter gather implementation)
Signed-off-by: NAmit Virdi <amit.virdi@st.com>
Cc: <stable@vger.kernel.org> # v3.9+
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Replace usb_gadget_driver's disconnect with udc-core's reset notifier at
bus reset handler.
Signed-off-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

HIRD threshold should be configurable by different platforms.

From DesignWare databook:
When HIRD_Threshold[4] is set to 1b1 and HIRD value is greater than or
equal to the value in HIRD_Threshold[3:0], dwc3 asserts output signals
utmi_l1_suspend_n to put PHY into Deep Low-Power mode in L1.

When HIRD_Threshold[4] is set to 1b0 or the HIRD value is less than
HIRD_Threshold[3:0], dwc3 asserts output signals utmi_sleep_n on L1.
Signed-off-by: NHuang Rui <ray.huang@amd.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

When parameter DWC_USB3_LPM_ERRATA_ENABLE is enabled in Andvanced
Configuration of coreConsultant, it supports of xHCI BESL Errata Dated
10/19/2011 is enabled in host mode. In device mode it adds the capability
to send NYET response threshold based on the BESL value received in the LPM
token, and the threhold is configurable for each soc platform.

This patch adds an entry that soc platform is able to define the lpm
capacity with their own device tree or bus glue layer.

[ balbi@ti.com : added devicetree documentation, spelled threshold
		completely, made sure threshold is only applied to
		proper core revisions. ]
Signed-off-by: NHuang Rui <ray.huang@amd.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

now that no UDC driver relies on the extra
'driver' argument to ->udc_stop(), we can
safely remove it.

This commit is based on previous work by
Robert Baldyga <r.baldyga@samsung.com> which
can be found at [1]; however that patch turned
out to have a high probability of regressing
many UDC drivers because of a blind search & replace
s/driver/$udc->driver/ which caused the 'driver'
argument to stop_activity() to be a valid non-NULL
pointer when it should be NULL, thus causing UDCs
to mistakenly call gadget driver's ->disconnect()
callback.

[1] http://markmail.org/message/x5zneg4xea4zntabAcked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Some gadget/function drivers might want to do
improper request recycling by allocating a single
request from one particular endpoint and queueing
it to another completely unrelated endpoint.

One such case was found with f_loopback.c.

To prevent such cases from happening again, let's
WARN() so we get a loud enough failure and persuade
users to report errors.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

whenever we get a Disconnect Interrupt, we should
make sure to update out udc state to NOT_ATTACHED,
otherwise sysfs will show wrong values.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Using ->prepare()/->complete() to mask/unmask
IRQs is wrong at least for dwc3. We need to
make sure that by the end of ->resume(), IRQs
are working and ready to fire because a child
device may need working IRQs for its own ->resume()
method.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

On ISOC endpoints the last trb_pool entry used as a
LINK TRB is not getting zeroed out correctly due to
memset being called incorrectly and in the wrong place.
If pool allocated from DMA was not zero-initialized
to begin with this will result in the size and ctrl
values being random garbage. Call memset correctly after
assignment of the trb_link pointer.

Fixes: f6bafc6a ("usb: dwc3: convert TRBs into bitshifts")
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: NJack Pham <jackp@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

According to our Gadget Framework API documentation,
->set_halt() *must* return -EAGAIN if we have pending
transfers (on either direction) or FIFO isn't empty (on
TX endpoints).

Fix this bug so that the mass storage gadget can be used
without stall=0 parameter.

This patch should be backported to all kernels since v3.2.

Cc: <stable@vger.kernel.org> # v3.2+
Suggested-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Instead of releasing the lock and calling locked
versions of our set_halt() methods, let's hold
the lock all the way through and call unlocked
versions of those functions.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

__dwc3_gadget_ep_set_halt() is the function which
handles the actual halt feature. In order to cope
with some extra cleanup comming as a follow-up patch
let's move the isochronous endpoint check there too.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Use the recently introduced usb_gadget_giveback_request() in favor of
direct invocation of the completion routine.

All places in drivers/usb/ matching "[-.]complete(" were replaced with a
call to usb_gadget_giveback_request(). This was compile-tested with all
ARM drivers enabled and runtime-tested for musb.
Signed-off-by: NMichal Sojka <sojka@merica.cz>
Acked-by: NFelipe Balbi <balbi@ti.com>
Tested-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When we're debugging hard-to-reproduce and time-sensitive
use cases, printk() poses too much overhead. That's when
the kernel's tracing infrastructure comes into play.

This patch implements a few initial tracepoints for the
dwc3 driver. More traces can be added as necessary in order
to ease the task of debugging dwc3.
Reviewed-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

No functional changes, just making sure we're dealing
with unsigned ints.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Those functions are only using within debugging
messages, grouping them into debug.h makes sense.

While at that, also add missing multiple inclusion
guard.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

After commit 2ec2a8be (usb: dwc3: gadget:
always enable IOC on bulk/interrupt transfers)
we created a situation where it was possible to
hang a bulk/interrupt endpoint if we had more
than one pending request in our queue and they
were both started with a single Start Transfer
command.

The problems triggers because we had not enabled
Transfer In Progress event for those endpoints
and we were not able to process early giveback
of requests completed without LST bit set.

Fix the problem by finally enabling Xfer In Progress
event for all endpoint types, except control.

Fixes: 2ec2a8be (usb: dwc3: gadget: always
	enable IOC on bulk/interrupt transfers)
Cc: <stable@vger.kernel.org> # v3.14+
Reported-by: NPratyush Anand <pratyush.anand@st.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

dep->endpoint.desc is checked at the beginning of
dwc3_gadget_ep_queue(), but after that it may be set to NULL
by another thread and then accessed again in dwc3_gadget_ep_queue().
This will lead to kernel oops.

Expand spinlock protection area to aviod race condition.
Signed-off-by: NZhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: NJiebing Li <jiebing.li@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The site-specific OOM messages are unnecessary, because they
duplicate the MM subsystem generic OOM message.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Remove 'start_new' variable from dwc3_endpoint_transfer_complete(),
since this variable has not been used.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In ISOC transfers, when free_slot points to the last TRB (i.e. Link
TRB), and all queued requests meet Missed Interval Isoc error, busy_slot
points to trb0.
	busy_slot->trb0
		   trb1
		   ...
	free_slot->trb31(Link TRB)

After end transfer and receiving the XferNotReady event, trb_left is
caculated as 1 which is wrong, and no TRB will be primed to the
endpoint.

The root cause is free_slot is not increased the same way as busy_slot.
When busy_slot is increased by one, it checks if points to a link TRB
after increasement, but free_slot checks it before increasement.
free_slot should behave the same as busy_slot to make the trb_left
caculation correct.
Reviewed-by: NPratyush Anand <pratyush.anand@st.com>
Signed-off-by: NZhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: NJiebing Li <jiebing.li@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

First usage of ret variable will re-write initial value. Thus, there is no need
to initialize it.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

this makes it slightly easier to read generic CMD
logs. It also helps make sure we're sending proper
parameters for each command.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

this makes it slightly easier to read link state
change interrupt logs.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

That way it's easy for humans looking at dmesg
and humans(?) looking at Databooks.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

so it seems like DWC3 IP doesn't clear stalls
automatically when we disable an endpoint, because
of that, we _must_ make sure stalls are cleared
before clearing the proper bit in DALEPENA register.

Cc: <stable@vger.kernel.org> # v3.4+
Reported-by: NJohannes Stezenbach <js@sig21.net>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Make dwc3_gadget_resize_tx_fifos() iterate only over IN
endpoints that are actually present, based on the
num_in_eps parameter. This terminates the loop so as to
prevent dereferencing a potential NULL dwc->eps[i] where
i >= (num_in_eps + num_out_eps).
Signed-off-by: NJack Pham <jackp@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We know what "value" is and it upsets static checkers that we appear to
have doubts about it.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

These were cut and paste from the ->disconnect function.

Fixes commit 30d577b9bcc4 ('usb: dwc3: gadget: call gadget driver's
->suspend/->resume')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

we need to pre-start stream transfers otherwise we
will never know when to start them.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

When going into bus suspend/resume we _must_
call gadget driver's ->suspend/->resume callbacks
accordingly. This patch implements that very feature
which has been missing forever.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

It's not always we need to force a transfer to be removed
from the core's internal cache. This extra argument will
help differentiating those two cases.
Signed-off-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

During superspeed, HIRD threshold should always
be zero. Curent driver wasn't making sure that
was the case.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

if we have hibernation configured, Databook
instructs us to set KEEP_CONNECT bit together
with RUN_STOP bit, in step 9 of section 12.3.6.1
Initialization for Hibernation Support.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

That argument will be used in later patches when we
have working hibernation support. For now, always
pass it as false.

The idea of this patch is to decrease to size of
following patches and slowly add hibernation building
blocks to the gadget side of dwc3 so that it becomes
very easy to review the actual hibernation code.

[ balbi@ti.com : rewrote patch on top of current
	tree. Added commit log. ]
Signed-off-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This function will be used during hibernation to get
the current link state. It will be needed at least
for Hibernation support.
Signed-off-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Revision 2.20a of the core has a known issue
which would generate bogus hibernation events
_and_ random failures on USB CV TD.9.23 test
case.

The suggested workaround is to ignore hibernation
events which don't match currently connected
speed.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

by setting IOC always, we can recycle TRBs a
lot sooner at the expense of some increased
CPU load.

The extra load seems to be quite minimal on
OMAP5 devices (instead of 1 IRQ for one MSC
transfer, we get
CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS).
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch adds "maxpacket_limit" to struct usb_ep. This field contains
maximum value of maxpacket supported by driver, and is set in driver probe.
This value should be used by autoconfig() function, because value of field
"maxpacket" is set to value from endpoint descriptor when endpoint becomes
enabled. So when autoconfig() function will be called again for this endpoint,
"maxpacket" value will contain wMaxPacketSize from descriptior instead of
maximum packet size for this endpoint.

For this reason this patch adds new field "maxpacket_limit" which contains
value of maximum packet size (which defines maximum endpoint capabilities).
This value is used in ep_matches() function used by autoconfig().

Value of "maxpacket_limit" should be set in UDC driver probe function, using
usb_ep_set_maxpacket_limit() function, defined in gadget.h. This function
set choosen value to both "maxpacket_limit" and "maxpacket" fields.

This patch modifies UDC drivers by adding support for maxpacket_limit.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>